CVE-2026-85497: falha crítica em CareCam HMT.CM2507 Firmware
CareCam CM2507 Use of Password Hash With Insufficient Computational Effort
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.3%
CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
CareCam · HMT.CM2507 FirmwareCVEs relacionadas — CareCam HMT.CM2507 Firmware
No mesmo produto, das mais perigosas para as menos.
CVE-2026-88259HIGHCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.5%CVE-2026-84398HIGHCareCam CM2507 Empty Password in Configuration FileEPSS 0.4%CVE-2026-81321CRITICALCareCam CM2507 Cleartext Storage of Sensitive InformationEPSS 0.3%CVE-2026-81305HIGHCareCam CM2507 Inclusion of Functionality from Untrusted Control SphereEPSS 0.3%CVE-2026-85478LOWCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.2%CVE-2026-84400LOWCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.2%